AWS IAM documentation change
Summary
Added PowerShell V5 examples for Get-STSSessionToken and AssumeRole operations with MFA integration
Security assessment
Documents MFA integration for temporary credential generation, which is a security feature, but does not indicate remediation of a specific security issue.
Diff
diff --git a/IAM/latest/UserGuide/id_credentials_mfa_sample-code.md b/IAM/latest/UserGuide/id_credentials_mfa_sample-code.md index 5838412e3..fa555fd7e 100644 --- a//IAM/latest/UserGuide/id_credentials_mfa_sample-code.md +++ b//IAM/latest/UserGuide/id_credentials_mfa_sample-code.md @@ -104,0 +105,47 @@ PowerShell +**Tools for PowerShell V5** + + +**Example 1: Returns an`Amazon.RuntimeAWSCredentials` instance containing temporary credentials valid for a set period of time. The credentials used to request temporary credentials are inferred from the current shell defaults. To specify other credentials, use the -ProfileName or -AccessKey/-SecretKey parameters.** + + + Get-STSSessionToken + + +**Output:** + + + AccessKeyId Expiration SecretAccessKey SessionToken + ----------- ---------- --------------- ------------ + EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN..... + +**Example 2: Returns an`Amazon.RuntimeAWSCredentials` instance containing temporary credentials valid for one hour. The credentials used to make the request are obtained from the specified profile.** + + + Get-STSSessionToken -DurationInSeconds 3600 -ProfileName myprofile + + +**Output:** + + + AccessKeyId Expiration SecretAccessKey SessionToken + ----------- ---------- --------------- ------------ + EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN..... + +**Example 3: Returns an`Amazon.RuntimeAWSCredentials` instance containing temporary credentials valid for one hour using the identification number of the MFA device associated with the account whose credentials are specified in the profile 'myprofilename' and the value provided by the device.** + + + Get-STSSessionToken -DurationInSeconds 3600 -ProfileName myprofile -SerialNumber YourMFADeviceSerialNumber -TokenCode 123456 + + +**Output:** + + + AccessKeyId Expiration SecretAccessKey SessionToken + ----------- ---------- --------------- ------------ + EXAMPLEACCESSKEYID 2/16/2015 9:12:28 PM examplesecretaccesskey... SamPleTokeN..... + + * For API details, see [GetSessionToken](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. + + + + @@ -703,0 +751,32 @@ PowerShell +**Tools for PowerShell V5** + + +**Example 1: Returns a set of temporary credentials (access key, secret key and session token) that can be used for one hour to access AWS resources that the requesting user might not normally have access to. The returned credentials have the permissions that are allowed by the access policy of the role being assumed and the policy that was supplied (you cannot use the supplied policy to grant permissions in excess of those defined by the access policy of the role being assumed).** + + + Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -Policy "...JSON policy..." -DurationInSeconds 3600 + + +**Example 2: Returns a set of temporary credentials, valid for one hour, that have the same permissions that are defined in the access policy of the role being assumed.** + + + Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 + + +**Example 3: Returns a set of temporary credentials supplying the serial number and generated token from an MFA associated with the user credentials used to execute the cmdlet.** + + + Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -SerialNumber "GAHT12345678" -TokenCode "123456" + + +**Example 4: Returns a set of temporary credentials that have assumed a role defined in a customer account. For each role that the third party can assume, the customer account must create a role using an identifier that must be passed in the -ExternalId parameter each time the role is assumed.** + + + Use-STSRole -RoleSessionName "Bob" -RoleArn "arn:aws:iam::123456789012:role/demo" -DurationInSeconds 3600 -ExternalId "ABC123" + + + * For API details, see [AssumeRole](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. + + + +